Microsoft Updated GH-500 Exam Questions and Answers by bernard

Current GitHub documentation requires Write access or higher to list, dismiss, and delete code scanning alerts. The PDF marks Triage, but that is not correct under the current repository-role permissions documented by GitHub. A user with Triage access can view code scanning alerts associated with pull requests, but Triage does not grant the broader permission required to manage the repository's code scanning alert list. Because Write is not one of the supplied choices, Maintain is the lowest listed role that exceeds Write and therefore has the required management capability. Read access does not permit alert management, and “View” is not one of GitHub's standard organization repository roles in this context. Accordingly, based on current official documentation, the technically correct option from the choices provided is B. Maintain.

A custom CodeQL configuration file can be stored in an external repository and referenced by multiple repositories. This allows an organization to centralize query packs, additional queries, query filters, path exclusions, threat-model configuration, and other CodeQL settings rather than duplicating the same settings across many workflow files. GitHub explicitly documents centralized configuration as a benefit of external configuration files. A token may be required when an advanced-setup workflow retrieves a configuration file from a private external repository, but providing the token is not the purpose of the configuration file itself. Likewise, a configuration file does not automatically choose a package, and query packs do not inherently disable the default query suite. Default queries are disabled only when the appropriate configuration option is deliberately specified. Therefore, C is correct.

The dependency graph in a repository is built by parsing manifest and lock files (like package.json, pom.xml, requirements.txt). It helps GitHub detect dependencies and cross-reference them with known vulnerability databases for alerting.

It is specific to each repository and does not show org-wide or cross-repo summaries.

When dealing with a data flow issue in a code scanning alert, clicking on "Show paths" provides a detailed view of the data's journey through the code. This includes the source of the data, the path it takes, and where it ends up (the sink). This information is crucial for understanding how untrusted data might reach sensitive parts of your application and helps in identifying where to implement proper validation or sanitization.​